1. Field of the Invention
The invention relates to field of network processing. Specifically, this invention relates to the inline processing of network traffic by a security processor between a framer device and a network processor.
2. Background
Communication networks and the number of users of such networks continue to increase. On-line sales involving both business-to-business and business to consumer over the Internet continues to proliferate. Additionally, the number of people that are telecommuting continues to grow. Both on-line sales and telecommuting are examples of usage of communication networks that typically involve private and sensitive data that needs to be protected during its transmission across the different communication networks.
Accordingly, security protocols, (e.g., Transport Layer Security (TLS), Secure Sockets Layer (SSL) 3.0, Internet Protocol Security (IPSec), etc.), have been developed to establish secure sessions between remote systems. These security protocols provide a method for remote systems to establish a secure session through message exchange and calculations, thereby allowing sensitive data being transmitted across the different communication networks to have a measure of security and/or untamperability.
These security protocols utilized encryption to protect the content of the messages sent between machines and network devices. In some instances, it is necessary that a network device handling a message decrypt at least a portion of the message in order to process the message, such as determining the message destination. Decryption algorithms often require significant processing resources. This puts a strain on network processors in a network device. A network processor often receives incoming packets from a framer, which is a device that is designed to receive frames of a specified format such as an Ethernet frame specified by IEEE 802.3. Framing devices are typically simple circuits capable of little but receiving and transmitting frames.
IPsec is a security framework for Internet Protocol (IP) networking that provides security services, including access control, integrity, authentication, protection against replay, confidentiality and similar services. IPsec utilizes a security association (SA) to implement its services. An SA is a simplex connection that is protected by one or more of the security services. An SA may be established between a pair of hosts, between a host and a security gateway, such as a router, or between a pair of gateways. IPsec connections between two peers consist of a pair of SAs as an SA is unidirectional. An SA contains all the information required to execute the security services of a IPsec packet. When created, an SA is assigned a security parameters index (SPI) by a receiving machine. A combination of the SPI and the destination IP addresses uniquely identifies an SA. A receiving host uses this information to determine which SA an incoming packet belongs to, and thus which algorithms for decryption and packet processing to apply to the packet. On the transmit side, the host performs a lookup based on the IP header information to find the SA to be used for encryption and packet processing.